JWT Authentication Tutorial - Node.js

JSON web tokens are one of the more popular ways to secure applications, especially in micro-services, but JWT is much more complex than a simple session based user authentication. In this video I will be breaking down exactly how to set up authentication with JWT and how to ensure the authentication is secure. I will also be showing how to setup refresh tokens with JWT so that your application is even more resilient and secure. Lastly, I will show how to invalidate refresh tokens which is the ultimate last step in securing an application.

📚 Materials/References:

🧠 Concepts Covered:

- Using refresh tokens with JWT
- Authenticating users with JWT
- Invalidating refresh tokens to log users out
- How to use JWT securely

🌎 Find Me Here:

#JWT #WDS #Authentication

[RasmusSchultz]

If you're building your own authentication system, it's a really good idea to include a flag in your payloads, to indicate whether that token was generated by authenticating with user credentials, or by using a refresh token. You can use this flag to authorize sensitive operations, such as changing your password or making payments - so if the user didn't log in recently, you can prompt them to log in again for sensitive operations. I would say this is a must for most applications.

[aram]

The single tutorial a dev should ever watch to get their heads wrapped around auth. Great pace and flow, pure English, pleasure to watch and listen to!

[ROCKEFELLAPRODUCTIONS]

You nailed these tutorials! I actually understand what you are explaining. You don't dilute it with unnecessary lingo in an attempt to sound smart. Thank you!

[SuperRockthing]

I discovered your channel 30 minutes ago and I have already subscribed. Your way of explaining things with minimum jargon and straight forward approach is so refreshing.Keep up the good work!

[chaopo]

I am so close to start crying of joy. I just spent so long trying to figure this out and then I found this video. Thank you so much. Honestly, you make my favourite tutorials.

[HamKibz]

It took me only 27 minutes to understand a simple concept that has been overly complicated by some bloggers. Thanks man, that was great.

[tinnyw]

Kyle has an amazing talent for teaching and this demystifies a lot of how to implement JWTs on the server end. If I may, one caveat I would add is adding access and refresh tokens in the body payload may be prone to being stolen in an XSS attack and depending on how secure you would like to make your site you might want to instead store them on http-only & secure cookies with a samesite set to at least lax so they're not read by Javascript and easily stolen. Again, this tutorial is on point on so many levels and amazing!

[majoulwa]

Hi, I would particularly like to praise your clear explanations and your super clear pronunciation. So it is very easy to understand, even for someone like me, who doesn't have a lot of experience in English and who often has trouble following English-language content with a strong accent. Really great!

[CodeDreamer]

Thanks for keeping it simple! You are living up to your name.

I watched 5 other jwt videos from well-known vloggers, and was still left confused.

This one was spot on. I get it now. Thanks!

[joonwantsdat]

I'm from South Korea, Kyle explains in a concise and straight plus simple easy way which makes me understand way better than Udemy courses.

[PaweAndruszkow]

this is how code tutorial video should look like! Simply, precize, no overtalking, just exact content we need, very good job!

[ryanlarge]

Thank you Kyle for another great video!! Especially by making some confusing topics much clearer and understandable in such little time. I think that many of us could benefit a thousand times more from this jwt knowledge if you created a sequel to this video, or even simply a separate video all together explaining how this backend logic is tied in with the front end via a js framework or keeping it simple like ejs or regular html. There is not a whole lot of good quality educational videos or documentation covering how it can all be connected and implemented into a true fullstack application. It took me a very long time to figure out how to serve my front end as well as authenticate users with jwt using ejs. I would love to see a good video on this from you. Thank you again!

[samgram]

You blink a lot, but holy crap! You speak so clearly and teach so well without any cuts! AMAZING! Thank you so much!

[mykolakecha]

This is probably the first time I'm writing a comment to a video. The reason - just wanted to acknowledge the quality of content. Especially how nice & simple everything is explained.

[michelkazi]

I'm using sails JS and their documentation is a hit or miss with a lot of things. They also have support for sessions instead of JWT. Your explanation and walkthrough were so nicely made that I was able to translate the logic of signing and verifying JWT into helpers for my project. Thank you!

[SaadShah]

I tried to implement JWT by watching different tutorials but i couldnt understand it, your video was the only video i understood, best node js videos keep it up; great work

[rajeshjamnadas]

No nonsense just straight to the point.
Clear and precise explanation.
Thanks you for time for a good tutorial, cheers!

[Bruno]

Exactily what I need! You just got a new subscriber. Simple, direct to the point, no use of database and other things, really direct to the point! Saves a lot of time. Thank you!

[lordrampenthump]

Its really hard to explain how valuable this channel is to me. Thank you for existing

[divyanshubhatnagar]

Have to say this was short and loaded with information. I really liked the part where you also explained the Auth and Resource server. Really appreciate the content :)